If your domain name has been stolen, hijacked, or transferred out of your registrar account without your permission, you are in the right place. DNAccess recovers stolen domain names for businesses, nonprofits, and individuals, and we have done it hundreds of times. Time matters more than anything else in these cases: a stolen domain can be moved to a second registrar, sold, and sold again within days. If you believe your domain has been taken, contact us now and then keep reading.
This page explains what domain theft is, how it happens, how to tell theft apart from an expiration problem, what to do in the first hours, and how DNAccess recovers a domain name once it has been taken. For a deeper walkthrough of each step, see our step-by-step guide to recovering a stolen domain name.
What Is Domain Theft?
Domain theft, also called domain hijacking, is the act of taking control of a domain name from its rightful registrant without permission. In practice it means that someone changed the ownership record, the registrar account, or the nameservers of a domain that had not expired, and the registrant did not authorize the change. A domain name is a digital asset. Like any asset, it can be taken, and like any asset it can usually be recovered when the right people act quickly with the right evidence.
Domain theft is often confused with two other situations. The first is expiration: the registrant did not renew the domain, it passed through the grace and redemption periods, and someone else registered it. The second is a legitimate transfer that the registrant forgot about or that a web developer, agency, or former employee carried out under an agreement that was never written down. Neither of those is theft, and each has its own recovery path. We cover the first on our expired domain name recovery page and the second in our article on recovering a domain name a web developer refuses to release.
How Domain Names Get Stolen
Almost every theft we investigate starts with access to an account rather than an attack on the domain itself. The common routes are the same ones that compromise any online account, and they are worth knowing because the method of theft determines the method of recovery.
Compromised email. The email address on the registrar account is the master key. If an attacker can read that mailbox, they can reset the registrar password, approve a transfer, and intercept the warning notices the registrar sends. Many thefts begin with an old, unmonitored email account that was still listed as the registrant contact.
Compromised registrar account. Weak or reused passwords, no two-factor authentication, and support-desk social engineering all lead to the same result: the thief logs in as you. Once inside, the thief can push the domain to another account at the same registrar, change the registrant details, or unlock the domain and request a transfer to a registrar in another country.
Phishing. Fake renewal notices, fake ICANN verification emails, and fake registrar login pages collect credentials from busy people. We have written about the fake ICANN verification emails that circulate in waves.
Insiders. A former employee, a former business partner, or a contractor who registered the domain in their own name can transfer it away during a dispute. These cases are often as much a legal matter as a technical one, and we cover the options in legal options for domain theft victims.
Why Thieves Steal Domain Names
Domain names have value. Good ones sell for thousands of dollars, and the best sell for millions. A thief who takes a domain can list it on an aftermarket platform at a steep discount and find a buyer within hours, and that buyer may have no idea the domain was stolen. Some thefts are not about money at all. A competitor, a disgruntled insider, or an extortionist may take a domain to shut down a website and its email, then demand payment to return it. Either way, the thief’s goal is to move the domain far enough and fast enough that the original owner gives up.
Has Your Domain Been Stolen, or Did It Expire?
Before anything else, rule out expiration. Domain names must be renewed, and a domain that was not renewed is not stolen, even if someone else now owns it. Check your registrar account for the expiration date and look for renewal notices in your inbox and spam folder. Then run a lookup at lookup.icann.org and compare three things against what you expect: the registrar, the registration and expiration dates, and the domain status codes.
If the registrar has changed, the creation date is the same, and the status shows clientTransferProhibited at a registrar you have never used, the domain was most likely transferred without your authorization. If the creation date is recent and the expiration date on your old record has passed, the domain most likely expired and was re-registered. Our domain name background check service pulls the historical WHOIS and DNS records that show exactly when and how the change happened, which is the evidence a registrar or a court will ask for.
What to Do in the First 24 Hours
When a domain name is stolen, it needs to be reported and acted on within hours, not days. The sooner the theft is reported, the easier the recovery. Here is the order we recommend.
Try to log in to your registrar account. If you cannot, use the password reset and watch for the email. If the email never arrives, your mailbox may be compromised as well, and securing it comes first.
Run the ICANN lookup and save a copy. Screenshot the result and note the date and time. Do the same for any WHOIS history you can retrieve.
Contact your registrar’s support team and ask them to open a case. Tell them the domain was transferred or pushed without authorization and ask them to contact the gaining registrar. Write down the case number, the name of the person you spoke with, and the time of the call.
Gather your evidence. Collect invoices and receipts for the domain, past renewal emails, screenshots of your account history, and anything that shows you as the registrant before the change.
File a report with your local law enforcement. It is rarely acted on directly, but a police report documents the theft and is often required later by registrars, by the transfer dispute process, and by courts.
Then contact DNAccess. We would rather hear from you on the first day than the tenth.
How DNAccess Recovers Stolen Domain Names
DNAccess does not rely on the general customer support queue. We have worked in the domain name industry for more than two decades, and we have direct relationships with registrars, registries, and the attorneys who handle domain disputes. When a domain has been stolen, we start by documenting the chain of custody: historical WHOIS, DNS history, registrar transfer logs, and the timeline of account activity. That evidence package is what moves a case from “we are looking into it” to action.
From there, the recovery path depends on where the domain went. When the losing and gaining registrars are both ICANN-accredited, the Transfer Undo Request Form, or TURF agreement, lets the two registrars reverse an unauthorized transfer without litigation when both agree. When a registrar will not cooperate, ICANN’s Transfer Dispute Resolution Policy and the registry’s own procedures come into play. When the domain has been resold or the thief has a plausible claim, a UDRP (Uniform Domain-Name Dispute-Resolution Policy) complaint or a lawsuit under the Anticybersquatting Consumer Protection Act may be the fastest route. We have used each of these, and we tell you plainly which one fits your case and what it will cost.
One example: Patterns.com was stolen from a Network Solutions account. DNAccess assembled the ownership history, worked with counsel to file a UDRP complaint on the basis of the owner’s common-law trademark and the fraudulent transfer, and the domain was returned to its rightful owner.
Why Organizations Come to DNAccess
We handle the cases other people could not. Many of our clients contact us after weeks of unanswered support tickets or after an agency told them the domain was gone for good. We know registrar policies, ICANN’s transfer and dispute rules, and the evidence standards that registrars and panels apply, because we work with them every week. Our founder, Bill Hartzer, also serves as an expert witness in domain name and internet marketing litigation, which means the evidence we assemble is built to stand up if a case goes to court.
Every case is different. Some are resolved in days with a single escalation. Others take a dispute proceeding or a court order. We will tell you which you are facing after we review the facts.
Protecting Your Domain Name After Recovery
Once a domain is back, the priority is making sure it cannot be taken again. Register it for multiple years. Turn on two-factor authentication at the registrar, preferably with a hardware key. Enable the registrar lock and, for your most important domains, a registry lock, which requires out-of-band verification before any change. Keep the registrant email on a secure, monitored account. Monitor the domain for registrant, nameserver, and status changes so that you hear about the next attempt within minutes rather than months. Our DNShield domain name monitoring service does exactly that, and our guide to domain name security best practices and our article on minimizing the risk of having your domain name stolen cover the full checklist.
Contact Us If Your Domain Name Has Been Stolen or Is Missing
If your domain name is missing from your registrar account, if the WHOIS record now shows someone else, or if you no longer have access to the account that holds it, contact DNAccess or call +1 214 236 4378. The initial consultation is free, and the sooner we start, the better the odds.